Reviewed October 30, 2026. Originally published in the SSAE 16 terminology series.
The carve-out method is a way to address a subservice organization in a service organization’s system description and report. The relevant services are described, but the subservice organization’s controls are excluded from the service auditor’s examination scope.
For SOC 1, that exclusion concerns the subservice organization’s relevant control objectives and related controls. The report and system description should make the boundary understandable to users.
Does Carve-out Remove the Need for Oversight?
No. The service organization still needs to consider the risks arising from the outsourced service and the controls it relies on. The system description identifies relevant responsibilities and monitoring within its scope.
Obtaining a supplier’s SOC report can be useful, but receiving a document is only the start of the review. Check the services and period covered, opinion, relevant exceptions, and the controls or responsibilities the report expects customers to perform.
Example Scenario: A service organization uses an outside hosting provider. Its reviewer checks whether the provider’s report covers the relevant hosting service and evaluates issues affecting its own system. Any required customer-side configuration or monitoring remains assigned to an owner.
What Should a Report User Ask?
Identify which activities are excluded, what evidence is available about them, and which complementary subservice organization controls are relevant to the report. If the evidence does not cover the service or period you rely on, ask how the gap is addressed.
The AICPA SOC resource library provides management and report-user guidance. For the wider report scope, see our SOC 1 overview.